Pena et al. [1]} presented an attack on the scheme [2]}, but their attack was not on the original parameters. In particular, the explicit construction proposed in [2]} is defined over \(\mathbb {F}_2\) , but the attack presented in [1]} is only efficient if the scheme was defined over \(\mathbb {F}_p\)  for a larger prime \(p\) . Pena et al. conjectured that for \(p = 2\)  their algorithm would run in quasi-polynomial time. Their attack is entirely classical and uses only the serial number given in the banknote.
